CVE-2021-40524

In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

4.29% chance of exploitation in the next 30 days, 90th percentile

Nuclei

high · CWE-434

Published

2021-09-05

Updated

2025-11-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/network/cves/2021/CVE-2021-40524.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-40509
• CVE-2021-40531
• CVE-2021-4050
• CVE-2021-40539
• CVE-2021-40492
• CVE-2021-40540